How to recover deleted files on Linux

Fortunately, recovering deleted files on Linux is simpler than on other operating systems. You can easily recover deleted files with tools like TestDisk, PhotoRec and Foremost.

Recover deleted files on Linux with TestDisk

TestDisk is an open source data recovery program that can effectively recover files or partitions that have been permanently deleted. It is packed with useful features and offers an easy to use interface. You can install TestDisk on Linux with the following commands:

# Ubuntu and Debian sudo apt install testdisk # RHEL and CentOS sudo yum install epel-release sudo yum install testdisk # Arch Linux sudo pacman -S testdisk

Once installed, start TestDisk by opening Terminal and entering the command testdisk.

sudo testdisk

Use the arrow keys on your keyboard to navigate and press Enter to select options. The first available option is to create a log file. Go ahead and create a file.

Màn hình sau sẽ hiển thị danh sách các phương tiện lưu trữ được kết nối với hệ thống của bạn. Chọn thiết bị có chứa các file đã xóa. Ví dụ đang sử dụng phương tiện /dev/sdb cho hướng dẫn này. Chọn phương tiện phù hợp của bạn và nhấn Proceed.

Màn hình tiếp theo sẽ nhắc bạn chọn loại phân vùng cho ổ đĩa. Chọn một loại phân vùng chính xác cho ổ đĩa của bạn. Lưu ý rằng TestDisk sẽ cố gắng tự phát hiện đúng loại. Vì vậy, nếu bạn không chắc chắn, hãy chuyển sang loại phân vùng được TestDisk phát hiện.

Bạn sẽ thấy một số tùy chọn có sẵn trên màn hình sau. Tùy chọn Analyse rất hữu ích để khôi phục các phân vùng bị mất. Tuy nhiên, ví dụ sẽ sử dụng tùy chọn Advanced để khôi phục các file đã xóa.

Tiếp theo, bạn sẽ thấy danh sách tất cả các phân vùng có trên thiết bị đã chọn của mình. Chọn phân vùng chứa dữ liệu đã xóa của bạn và chọn Undelete từ menu dưới cùng.

TestDisk will scan MFT entries for deleted files on this partition and list them here. The example is looking for the picture.jpg file displayed on this screen.

You can select/deselect specific files using : and all files using a. After selecting the files to recover, press C to copy them.

You will be prompted to choose a restore destination. Navigate there and press C to save the file.

Recover deleted files on Linux with PhotoRec

PhotoRec is another powerful data recovery program created by the developers of TestDisk. It was developed to recover deleted photos on Linux but has now evolved into a full-fledged program that can use PhotoRec to recover all types of deleted files.

The difference between TestDisk and PhotoRec is that PhotoRec can access files even from drives that have been damaged beyond repair. It uses file signatures to detect deleted files, which makes the tool extremely powerful. However, files accessed via PhotoRec do not retain their original filenames.

You can install PhotoRec on different Linux distributions using the same commands used to install TestDisk. So if you already have TestDisk installed, you don't need to reinstall PhotoRec. If you don't have TestDisk installed before, see above and install testdisk package.

sudo photorec

This command will start PhotoRec and take you to the Start menu. The layout is similar to TestDisk and so is the navigation. You will be prompted to select the drive media. Select the correct one you want and click Proceed.

Then you will need to select the source partition. Select the appropriate partition and select File Opt from the bottom menu.

Here, you can specify the type of deleted files. PhotoRec selects all file types by default. You can disable all using s and select a specific type using x. The example is choosing jpg to restore image files.

Now, go back with q and select the Search option to start recovering files on Linux.

Then you will need to select the file system type. Select Other if the source partition is not ext3/ext4.

At this step, you must specify whether to search the selected file types in the entire partition or only in the free space. The example is choosing the Free Space option for faster searching.

The next step asks the user to select the destination folder. Make sure not to save the file on the same partition that you are scanning. Navigate to the desired location using the arrow keys and press C to save.

PhotoRec will now scan for empty sectors and save the recovered files to the selected destination. It will save the recovered files in a folder named recup_dir.

Recover deleted files with Foremost on Linux

Foremost is a free data recovery tool for Linux. It comes with a simple CLI interface. Although the software is not as interactive as TestDisk or PhotoRec, it still proves to be useful in certain situations.

Thanks to the plethora of high-quality data recovery programs, recovering deleted files is quite easy on Linux. You can choose any of the above tools based on the type of deleted files and your system partition configuration. However, the article recommends TestDisk and PhotoRec because they provide simple and clear interactive prompts.

Since data recovery can be a nightmare for many people, you should always store backups on an external device. It will help to get back deleted data with just a few clicks.

Kareem Winters

Update 16 May 2022